TI-2019-02632 Aliases CVE-2019-3567 GHSA-96gq-m97m-9ppg

Improper access control in Meta osquery

LOW 39CWE-284Published 2019-06-03 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-284.

Summary

In some configurations an attacker can inject a new executable path into the extensions.load file for osquery and hard link a parent folder of a malicious binary to a folder with known 'safe' permissions. Under those circumstances osquery will load said malicious executable with SYSTEM permissions. The solution is to migrate installations to the 'Program Files' directory on Windows which restricts unprivileged write access. This issue affects osquery prior to v3.4.0.

Why it matters now

EPSS 0.0166 76th percentileScored 2026-11-07

Fix Fixed osquery (Facebook): 3.4.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Meta	osquery	3.4.0; before 3.4.0	3.4.0	Patch available	CNA

osquery VendorMeta Affected 3.4.0; before 3.4.0 Fixed in 3.4.0 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:linuxfoundation:osquery::::::::	before 3.4.0	Vulnerable	backstage

cpe:2.3:a:linuxfoundation:osquery:*:*:*:*:*:*:*:* Versions before 3.4.0 Vulnerable ·backstage

Remediation

Fix · CNA osquery (Facebook) Fixed in 3.4.0

Timeline

2026-10-02 Threatist record created from CVE-2019-3567
2026-10-03 Alias added: GHSA-96gq-m97m-9ppg

References

Advisory 1

https://www.facebook.com/security/advisories/cve-2019-3567

TI-2025-34861 Deserialization of untrusted data in Meta react-server-dom-webpack KEVCVSS 3.1CRITICAL 10.0
TI-2019-02633 Heap-based buffer overflow in Meta WhatsApp for Android KEVCVSS 3.1CRITICAL 9.8
TI-2019-13416 Cross-site scripting in Meta WhatsApp Desktop KEVCVSS 3.1HIGH 8.2
TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
TI-2025-34857 Incorrect authorization in Meta WhatsApp Desktop for Mac KEVCVSS 3.1MEDIUM 5.4
TI-2025-34863 Deserialization of untrusted data in Meta react-server-dom-webpack CVSS 3.1HIGH 7.5

See all 191 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences